# ADR-0009 — Optional audio recording & consent

- **Status:** Accepted
- **Date:** 2026-06-30
- **Context source:** User request (2026-06-30); design doc §"Audio Capture and Privacy"

## Context

WA captures system audio to transcribe it. Transcription needs audio only transiently — the design
already treats `audio.wav` as the source of truth for crash recovery. However, **persisting** a
full meeting recording is a distinct, higher-stakes choice: it is more sensitive than a transcript,
and recording conversations without consent is **illegal in some jurisdictions** (e.g. all-party /
two-party consent regions). The user wants recording to be a deliberate opt-in, saved as `.wav`,
with a clear legal caution.

## Decision

1. **Recording is OFF by default.** A per-meeting and a global default toggle ("Record this
   meeting") control whether the captured audio is **retained** after processing.
2. When recording is **off**, audio is still written to a working file during the session (so
   transcription and crash recovery work), but that working audio is **deleted** when the meeting
   is finalized — only the transcript/notes persist.
3. When recording is **on**, the working audio is kept as the meeting's permanent `audio.wav`.
4. **Consent notice.** The first time a user enables recording (and surfaced near the toggle
   thereafter), WA shows a non-blocking notice: *"Recording conversations without the consent of
   participants may be illegal in your region. Check your local recording laws."* The user must
   acknowledge once; the acknowledgment is stored. This is a caution, **not legal advice**.
5. The recording indicator (FR-CAP-4) already makes active capture obvious; when retention is on,
   the UI additionally indicates the meeting is being **saved**.

## Consequences

- **Positive:** privacy-respecting default (transcript-only); users opt into the heavier artifact
  knowingly; the legal caution reduces the chance of inadvertent unlawful recording; reuses the
  existing working-audio path, so little new machinery.
- **Negative / care:** the "delete working audio on finalize" path must be robust and must not race
  with crash recovery — deletion happens only after the transcript is successfully finalized
  (audio remains the source of truth until then, ADR-0006); retention/sync must treat a non-recorded
  meeting as "no audio artifact exists".
- **Interaction with sync (ADR-0010):** only **retained** recordings are eligible to upload; a
  non-recorded meeting can still sync its transcript/notes.

## Revisit if
We add region detection to tailor the consent copy, or a "record microphone too" feature (separate
consent considerations).